Stop 02 · Networking Fundamentals for SecurityTopics · 4/10

HTTP/HTTPS & TLS

In short

Almost everything you use online talks HTTP, and TLS is what keeps it private and genuine. Knowing the handshake helps you debug broken sites and spot traffic that's been tampered with.

The protocol underlying almost all web traffic, and TLS — the encryption layer securing it — understanding the TLS handshake and certificate validation is essential for spotting man-in-the-middle attack risks.

The blob takes a locked parcel from a courier after checking the courier's ID card.

Think of it like this

A locked courier parcel

Before you take a parcel, you check the courier's ID card. Then you both use a code only you two know to open the lock. TLS works like that: check the server's certificate, agree on a secret key, then send everything locked.

Watch it happen

The TLS 1.3 handshake, simplified

Browser

Server

ClientHello + key share

1/6The browser lists the ciphers it supports and sends its half of a key exchange.

The big ideas

What you need to know

HTTP is plain text

A request has a method, path, headers and maybe a body. Without TLS, anyone on the path can read it.

TLS gives three things

Encryption (privacy), integrity (no silent changes) and authentication (it really is that server).

Certificates prove identity

A certificate authority vouches that a public key belongs to a domain. Browsers trust a built-in list of them.

Warnings mean something

A certificate error can mean a misconfigured site or someone intercepting traffic. Never train users to click through.

See it in code

Walk through the code

bash

1# See TLS version, cipher and certificate chain2openssl s_client -connect example.com:443 -servername example.com </dev/null3 4# Just the certificate's subject, issuer and dates5openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null \6  | openssl x509 -noout -subject -issuer -dates

1/2s_client does a real TLS handshake and prints the protocol, cipher and full certificate chain.

Check the issuer and expiry date. Expired certificates are one of the most common causes of outages.

Save yourself the pain

Common mistakes

Oops

Thinking the padlock means a site is safe.

Do this instead

It only means the connection is encrypted to that domain. Phishing sites get free certificates too.

Oops

Leaving old TLS 1.0 and 1.1 enabled on servers.

Do this instead

Allow TLS 1.2 and 1.3 only. Older versions have known weaknesses and modern browsers have dropped them.

Your mission

Inspect three certificates

~15 min

Quick check

On office Wi-Fi, your browser warns that a site's certificate was issued by an unknown authority. What could this mean?

Go deeper

1Inspect a website's TLS certificate details in your browser.
2Learn the basic steps of a TLS handshake and where it can be attacked (e.g. downgrade attacks).
3Understand why HTTPS alone doesn't guarantee a site is trustworthy, only that the connection is encrypted.